Explainers

Personal data is any information relating to a living person who can be identified from it, directly or indirectly. If you can single someone out, by name, an ID number, location data or an online identifier, alone or combined with other information you hold or are likely to get, it is personal data and data protection law applies to it.

Special category data is the sensitive personal data listed in Art 9 UK GDPR, such as health, ethnicity and biometric data. You can only use it if you have an ordinary lawful basis under Art 6 and also meet one of the conditions in Art 9(2), several of which need a further condition in Schedule 1 to the DPA 2018 and an appropriate policy document.

Criminal offence data is personal data about criminal convictions and offences, including allegations, proceedings and sentences. Unless you act under official authority, you can only process it if a condition in Schedule 1 to the DPA 2018 applies, on top of an ordinary lawful basis.

The controller decides why and how personal data is processed; the processor only acts on the controller's documented instructions. The label in a contract does not decide it: the facts do. Most legal duties fall on the controller, but processors have direct duties too.

The seven principles in Art 5 UK GDPR are the core rules every use of personal data must meet: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability. Almost every other obligation is a way of meeting one of them.

Accountability means being able to show, with evidence, that you comply. It is a legal duty in its own right under Art 5(2) UK GDPR, so a controller that cannot produce its records, policies and assessments is in breach even if its processing happens to be lawful.

Every use of personal data needs one of the lawful bases in Art 6 UK GDPR, chosen before you start and recorded. There are seven: consent, contract, legal obligation, vital interests, public task, recognised legitimate interests and legitimate interests. No basis is better than another; the right one depends on the purpose.

Valid consent is a freely given, specific, informed and unambiguous indication of a person's wishes, given by a clear affirmative act and as easy to withdraw as to give. You need it where no other lawful basis fits, and PECR separately requires it for most electronic marketing and non-essential cookies.

Legitimate interests is the lawful basis for processing that is necessary for a genuine interest of yours or a third party, where that interest is not overridden by the person's rights. You show it with a three-part test, usually written up as a legitimate interests assessment (LIA) before you start. Recognised legitimate interests, for listed purposes, skip the balancing step.

An appropriate policy document (APD) is a short written explanation of how you comply with the principles and how you retain and erase data when you rely on certain Schedule 1 conditions for special category or criminal offence data. Most of those conditions say an APD is required.

A data protection impact assessment (DPIA) is a structured assessment of the risks a project poses to people's rights and how you will reduce them. It is compulsory before any processing that is likely to result in a high risk, and in three cases the law names outright, plus the cases on the regulator's published list.

Prior consultation means sending your DPIA to the regulator before you start processing, because the DPIA shows a high risk you cannot reduce. It is required in that situation only, and the regulator then has up to eight weeks, extendable by six, to give written advice.

A record of processing activities (ROPA) is a written inventory of what personal data you process, why, about whom, who receives it, where it goes and how long you keep it. Every controller and processor must keep one; organisations with fewer than 250 staff are exempt only for processing that is occasional, low risk and free of special category or criminal offence data, which in practice leaves most organisations needing one.

A data protection officer (DPO) is an independent expert who advises on and monitors your compliance and is the contact point for people and the regulator. You must appoint one if you are a public authority, or if your core activities involve large-scale regular and systematic monitoring of people, or large-scale processing of special category or criminal offence data.

A UK representative is a person or company in the UK that an overseas controller or processor appoints to act for it on UK data protection matters. You need one if you are not established in the UK but offer goods or services to people in the UK or monitor their behaviour, unless your processing is occasional and low risk or you are a public authority.

Every organisation and sole trader that processes personal data must pay an annual fee to the regulator unless an exemption applies. From 2025-02-17 the fee is £52 (tier 1), £78 (tier 2) or £3,763 (tier 3), depending on turnover and staff numbers, less £5 if you pay by direct debit.

A privacy notice is the information you must give people about how you use their personal data: who you are, why and on what basis you use it, who you share it with, how long you keep it and what rights they have. You must give it when you collect data from them, or within a month if you get it from someone else.

A data processing agreement is the contract a controller must have with every processor that handles personal data for it. Art 28 UK GDPR lists the terms it must contain, including acting only on documented instructions, confidentiality, security, sub-processor controls, help with rights and breaches, deletion at the end, and audit rights.

A data sharing agreement sets out how two or more controllers share personal data: the purpose, the lawful basis, what data, security, retention and how each will handle rights requests. The law does not demand one in every case, but the statutory data sharing code expects one for systematic sharing, and joint controllers must have an arrangement.

Data protection by design and by default means building data protection into systems and processes from the start, and setting them so that by default only the personal data needed for each purpose is processed. It is a legal duty under Art 25 UK GDPR, and from 2026-02-05 online services likely to be used by children must also account for children's higher protection matters.

A personal data breach is any security failure that leads to personal data being lost, destroyed, altered, disclosed or accessed without authority, including making it unavailable. You must report it to the regulator within 72 hours of becoming aware unless it is unlikely to result in a risk to people, and tell the people affected without undue delay if the risk to them is high.

Since 2026-06-19 every controller must have a process for data protection complaints: make it easy to complain, for example with an electronic form, acknowledge each complaint within 30 days, investigate without undue delay and tell the person the outcome. The regulator expects people to complain to you first.

A subject access request is a person asking for a copy of their personal data and information about how you use it. You must respond within one calendar month, extendable by two months for complex or numerous requests, and you need only provide what a reasonable and proportionate search would find.

The right to rectification lets people have inaccurate personal data about them corrected, and incomplete data completed. You must respond within one month, and tell anyone you shared the data with unless that is impossible or involves disproportionate effort.

The right to erasure, or right to be forgotten, lets people have their personal data deleted where one of the grounds in Art 17 applies, such as the data no longer being needed or consent being withdrawn. It is not absolute: it gives way to legal obligations, legal claims, freedom of expression and some public interest purposes.

The right to restriction lets people ask you to stop using their data, other than storing it, while a dispute is resolved or where they need it kept for a legal claim. You must lift the restriction only after telling them.

Data portability lets people receive the personal data they gave you in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible. It applies only to data processed by automated means on the basis of consent or contract.

People can object to processing based on public task or legitimate interests, and you must stop unless you show compelling legitimate grounds that override theirs. Objection to direct marketing is absolute: you must stop straight away, with no exceptions.

Since 2026-02-05, significant decisions based solely on automated processing are allowed if safeguards are in place: you must tell people, let them make representations, offer human intervention and let them contest the decision. Stricter limits apply where special category data is used.

A restricted transfer is sending personal data, or making it accessible, to a recipient outside the UK that is a separate organisation. You can only do it if the destination is covered by UK adequacy regulations, or you put an appropriate safeguard in place, such as the IDTA or the UK Addendum, that meets the data protection test, or an exception applies.

UK adequacy regulations, made by the Secretary of State, confirm that a country, territory, sector or international organisation protects personal data to a standard not materially lower than the UK's, so transfers there need no further safeguard. The EEA, EU institutions, the countries with EU adequacy in 2020, the Republic of Korea and the United States (for certified organisations) are covered.

The Age appropriate design code, known as the Children's code, is a statutory code of practice with 15 standards for online services likely to be accessed by children under 18. It applies to apps, games, social media, connected toys and websites, not only services aimed at children, and the regulator and courts must take it into account.

Anonymised data cannot identify anyone by any means reasonably likely to be used, so it falls outside data protection law. Pseudonymised data has identifiers replaced, but can still be linked back to people with extra information, so it is still personal data and all the rules apply.

The Privacy and Electronic Communications Regulations 2003 (PECR) set specific rules on electronic marketing by phone, text, email and fax, on cookies and similar technologies, and on the security of public communications services. They apply to any organisation that does those things, whether or not it processes personal data in other ways, and sit alongside the UK GDPR.

You can only send marketing emails or texts to individuals who have specifically consented, unless the soft opt-in applies: you got their details in a sale or negotiation, you market your own similar products, and you gave them a chance to opt out at collection and in every message. Since 2026-02-05 charities can use a similar soft opt-in for supporters.

You can make live marketing calls to anyone who has not told you they object and is not registered with the Telephone Preference Service (TPS), or the Corporate TPS for businesses, unless they have specifically told you they do not object to your calls. Automated recorded marketing calls need prior specific consent.

You need consent to store or access information on someone's device, including cookies, pixels and fingerprinting, unless an exception applies. Since 2026-02-05 the exceptions cover first-party analytics to improve your service, adapting how the service looks to the user's settings, security and emergency location, as well as what is strictly necessary. Advertising still needs consent.

Providers of public electronic communications services, such as telecoms and internet access providers, must report a personal data breach to the regulator within 72 hours of becoming aware of it, and tell affected subscribers without undue delay if it is likely to adversely affect them. The deadline was 24 hours before 2025-08-20.

A freedom of information request is any written request to a public authority for recorded information it holds. Anyone, anywhere, can make one without saying why. The authority must say whether it holds the information and, unless an exemption applies, provide it within 20 working days.

Under FOIA, a public authority is a body listed in Schedule 1, a body designated by order, or a company wholly owned by the public sector. The EIR reach further, also covering bodies with public administrative functions or special legal powers, and bodies under the control of a public authority.

Environmental information is any information on the state of the environment, factors and measures affecting it, and related reports, analyses and human health and safety. Requests for it must be handled under the Environmental Information Regulations, not FOIA, and the EIR have a presumption in favour of disclosure and can be made verbally.

For qualified exemptions, information can be withheld only if the public interest in maintaining the exemption outweighs the public interest in disclosure. Under the EIR every exception is qualified, and the balance starts with a presumption in favour of disclosure.

Normally an authority must tell a requester whether it holds the information. Neither confirm nor deny (NCND) is the response used where saying whether the information exists would itself reveal something exempt, such as whether someone is under investigation.

Under FOIA an authority can refuse a request if finding and extracting the information would cost more than £600 for central government or £450 for other authorities, with staff time charged at £25 an hour (24 or 18 hours). Under FOISA the limit is £600 at no more than £15 an hour. The EIR have no cost limit, but a request can be manifestly unreasonable.

A vexatious request is one that is a manifestly unjustified, inappropriate or improper use of the right of access. An authority need not comply with it under FOIA s.14. The focus is on the request, not the requester, weighing its burden against its value and purpose.

An internal review is the authority reconsidering its own response when the requester is unhappy. It is mandatory under the EIR, EIRS and FOISA, and expected under the FOIA code of practice; requesters normally need one before complaining to the regulator. FOIA reviews should take 20 working days, and no more than 40.

A publication scheme is a public authority's commitment to publish certain classes of information routinely, without waiting for requests. Every FOIA and FOISA public authority must adopt and maintain one, normally the model scheme approved by the regulator, and publish information in line with it.

Scottish public authorities, such as the Scottish Government, Scottish councils, NHS Scotland and Police Scotland, are covered by FOISA 2002 and the Scottish Information Commissioner. UK-wide authorities operating in Scotland, such as UK government departments and the BBC, stay under FOIA 2000 and the UK regulator.

First ask the authority for an internal review. If still unhappy, complain to the regulator, which can issue a decision notice requiring disclosure. Its decision can be appealed to the First-tier Tribunal and then, on a point of law, to the Upper Tribunal. In Scotland, apply to the Scottish Information Commissioner, with appeal on a point of law to the Court of Session.